CVE-2026-73563
Received Received - Intake

Authentication Bypass via Wildcard URI Matching in Backstage

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73563
EUVD
EUVD-2026-58177

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
backstage plugin-auth-backend to 0.29.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated OAuth account takeover flaw in the @backstage/plugin-auth-backend. It allows attackers to bypass redirect URI allowlist checks by exploiting wildcard patterns in matching. Wildcards in patterns like https://*.example.com/callback can incorrectly match unintended URLs such as https://attacker.example/x.example.com/callback. The issue affects experimental features when custom allowlist patterns with wildcards in hostnames or without explicit protocols are used.

Detection Guidance

Check if your Backstage instance uses versions <= 0.29.1 and has experimental features enabled. Review auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns for wildcard or protocol-less patterns. Inspect OAuth client configurations for suspicious redirect URIs.

Impact Analysis

An attacker could register a malicious OAuth client with a redirect URI pointing to an attacker-controlled host. This could allow the attacker to receive OAuth authorization codes after a victim completes the flow, potentially leading to unauthorized access to the victim's account. The impact is limited as the affected features are disabled by default.

Mitigation Strategies

Upgrade to Backstage version 0.29.2 or later. Disable experimental features if not needed. Replace wildcard patterns in allowlists with explicit hostnames and protocols. Ensure redirect URIs do not contain embedded credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart